From 5c5ef4eb0c6bd4175a6e87d331d65ade5f5b729f Mon Sep 17 00:00:00 2001
From: sgm0422 <976204163@qq.com>
Date: Fri, 12 Jun 2020 16:41:40 +0800
Subject: [PATCH] * Fix acl and rights.

---
 config/zentaopms.php                      |   5 +
 db/update15.0.sql                         |   2 +
 module/common/model.php                   | 118 ++++++++++++++--
 module/group/lang/resource.php            |  35 +++--
 module/program/config.php                 |   4 -
 module/program/control.php                |  15 +-
 module/program/lang/zh-cn.php             |   4 +-
 module/program/model.php                  |   6 +-
 module/program/view/browsebygrid.html.php |   2 +
 module/program/view/browsebylist.html.php |   2 +-
 module/user/control.php                   |   2 +-
 module/user/model.php                     | 164 +++++++++++++++-------
 12 files changed, 260 insertions(+), 99 deletions(-)

diff --git a/config/zentaopms.php b/config/zentaopms.php
index c31f3a9d42..f400b7384f 100644
--- a/config/zentaopms.php
+++ b/config/zentaopms.php
@@ -218,3 +218,8 @@ $config->objectTables['module']      = TABLE_MODULE;
 $config->objectTables['caselib']     = TABLE_TESTSUITE;
 $config->objectTables['entry']       = TABLE_ENTRY;
 $config->objectTables['webhook']     = TABLE_WEBHOOK;
+
+/* Program privs.*/
+$config->programPriv = new stdclass();
+$config->programPriv->scrum = array('product', 'story', 'productplan', 'release', 'project', 'task', 'build', 'qa', 'bug', 'testcase', 'testsuite', 'testreport', 'caselib', 'doc', 'report', 'repo', 'svn', 'git', 'search', 'tree', 'file', 'jenkins', 'job', 'ci', 'branch');
+$config->programPriv->cmmi  = $config->programPriv->scrum + array('workestimation', 'durationestimation', 'budget', 'programplan', 'review', 'reviewissue', 'weekly', 'milestone', 'design', 'issue', 'risk', 'auditplan', 'nc', 'cm', 'pssp');
diff --git a/db/update15.0.sql b/db/update15.0.sql
index 31b9e02f22..517326e5ee 100644
--- a/db/update15.0.sql
+++ b/db/update15.0.sql
@@ -12,3 +12,5 @@ ALTER TABLE `zt_group` ADD `program` mediumint(8) NOT NULL AFTER `id`;
 INSERT INTO `zt_group` (`name`, `role`, `desc`, `acl`, `developer`) VALUES ('项目管理员', 'prgadmin', '项目管理员可以维护项目的权限', NULL, '1');
 
 ALTER TABLE `zt_usergroup` ADD `program` text NOT NULL;
+
+ALTER TABLE `zt_userview` ADD `programs` mediumtext COLLATE 'utf8_general_ci' NOT NULL AFTER `account`;
diff --git a/module/common/model.php b/module/common/model.php
index bb524c8c04..55d18d7118 100644
--- a/module/common/model.php
+++ b/module/common/model.php
@@ -919,10 +919,10 @@ class commonModel extends model
      * @access public
      * @return bool
      */
-    public static function printLink($module, $method, $vars = '', $label, $target = '', $misc = '', $newline = true, $onlyBody = false, $object = null, $programID = 0)
+    public static function printLink($module, $method, $vars = '', $label, $target = '', $misc = '', $newline = true, $onlyBody = false, $object = null)
     {
         if(!commonModel::hasPriv($module, $method, $object)) return false;
-        echo html::a(helper::createLink($module, $method, $vars, '', $onlyBody, $programID), $label, $target, $misc, $newline);
+        echo html::a(helper::createLink($module, $method, $vars, '', $onlyBody), $label, $target, $misc, $newline);
         return true;
     }
 
@@ -1548,6 +1548,13 @@ EOD;
             if(!defined('IN_UPGRADE')) $this->session->user->view = $this->loadModel('user')->grantUserView();
             $this->app->user = $this->session->user;
 
+            $inProgram = isset($this->lang->navGroup->$module) && $this->lang->navGroup->$module == 'program';
+            if(!defined('IN_UPGRADE') and $inProgram) 
+            {
+                $this->resetProgramPriv($module, $method);
+                //$this->resetProgramAcl($module, $method);
+            }
+
             if(!commonModel::hasPriv($module, $method)) $this->deny($module, $method);
         }
         else
@@ -1575,10 +1582,9 @@ EOD;
         /* Check is the super admin or not. */
         if(!empty($app->user->admin) || strpos($app->company->admins, ",{$app->user->account},") !== false) return true;
 
-        /* If is the program admin, have all program related privs. */
+        /* If is the program admin, have all program privs. */
         $inProgram = isset($lang->navGroup->$module) && $lang->navGroup->$module == 'program';
         if(strpos(",{$app->user->rights['programs']},", ",{$app->session->program},") !== false && $inProgram) return true; 
-        if($inProgram) self::resetProgramPriv($module, $method);
 
         /* If not super admin, check the rights. */
         $rights = $app->user->rights['rights'];
@@ -1615,23 +1621,107 @@ EOD;
      * @access public
      * @return void
      */
-    public static function resetProgramPriv($module, $method)
+    public function resetProgramPriv($module, $method)
     {
-        global $app, $lang, $dbh;
         /* Get user program priv. */
-        if(!$app->session->program) return;
-        $program       = $dbh->query("SELECT * FROM " . TABLE_PROJECT . " WHERE `id` = '{$app->session->program}'")->fetch();
-        $programRights = $dbh->query("SELECT t3.module, t3.method FROM " . TABLE_GROUP . " AS t1 LEFT JOIN " . TABLE_USERGROUP . " AS t2 ON t1.id = t2.group LEFT JOIN " . TABLE_GROUPPRIV . " AS t3 ON t2.group=t3.group WHERE t1.program = " . "'{$app->session->program}'" . ' AND t2.account = ' . "'{$app->user->account}'")->fetchAll();
+        if(!$this->app->session->program) return;
+        $program       = $this->dao->findByID($app->session->program)->from(TABLE_PROJECT)->fetch();
+        $programRights = $this->dao->select('t3.module, t3.method')->from(TABLE_GROUP)->alias('t1')
+            ->leftJoin(TABLE_USERGROUP)->alias('t2')->on('t1.id = t2.group')
+            ->leftJoin(TABLE_GROUPPRIV)->alias('t3')->on('t2.group=t3.group')
+            ->where('t1.program')->eq($program->id)
+            ->andWhere('t2.account')->eq($this->app->user->account)
+            ->fetchAll();
 
-        /* Group priv by module. */
+        /* Group priv by module the same as rights. */
         $programRightGroup = array();
         foreach($programRights as $programRight) $programRightGroup[$programRight->module][$programRight->method] = 1;
 
         /* Reset priv by program privway. */
-        $rights = $app->user->rights['rights'];
-        $acls   = $app->user->rights['acls'];
-        if($program->privway == 'extend') $app->user->rights['rights'] = array_merge_recursive($programRightGroup, $rights);
-        if($program->privway == 'reset')  $app->user->rights['rights'] = $programRightGroup;
+        $rights = $this->app->user->rights['rights'];
+        if($program->privway == 'extend') $this->app->user->rights['rights'] = array_merge_recursive($programRightGroup, $rights);
+        if($program->privway == 'reset')  
+        {
+            /* If priv way is reset, unset common program priv, and cover by program priv. */
+            foreach($rights as $moduleKey => $methods) 
+            {
+                if(in_array($moduleKey, $this->config->programPriv->cmmi)) unset($rights[$moduleKey]);
+            }
+            
+            $this->app->user->rights['rights'] = array_merge($rights, $programRightGroup);
+        }
+    }
+
+    /**
+     * Reset program acl.
+     *
+     * @param  string $module
+     * @param  string $method
+     * @static
+     * @access public
+     * @return void
+     */
+    public static function resetProgramAcl($module, $method)
+    {
+        global $app, $lang, $config, $dbh;
+        /* Get user program acl. */
+        if(!$app->session->program) return;
+        $groups = $dbh->query('SELECT t1.acl FROM ' . TABLE_GROUP . ' AS t1 LEFT JOIN ' . TABLE_USERGROUP . ' AS t2 on t1.id = t2.group WHERE t2.account = ' . "'{$app->user->account}'" . ' AND t1.program = ' . "'{$app->session->program}'" . ' AND t1.role != "limited"')->fetchAll();
+
+        $productAllow = false;
+        $projectAllow = false;
+
+        if(empty($groups)) return;
+        foreach($groups as $group)
+        {
+            $acl = json_decode($group->acl, true);
+            if(empty($group->acl))
+            {
+                $productAllew = true;
+                $projectAllow = true;
+                break;
+            }
+
+            if(empty($acl['products'])) $productAllow = true;
+            if(empty($acl['projects'])) $projectAllow = true;
+            if(empty($acls) and !empty($acl))
+            {
+                $acls = $acl;
+                continue;
+            }
+
+            if(!empty($acl['products'])) $acls['products'] = !empty($acls['products']) ? array_merge($acls['products'], $acl['products']) : $acl['products'];
+            if(!empty($acl['projects'])) $acls['projects'] = !empty($acls['projects']) ? array_merge($acls['projects'], $acl['projects']) : $acl['projects'];
+
+            if($productAllow) $acls['products'] = array();
+            if($projectAllow) $acls['projects'] = array();
+        }
+
+        $userView = $this->dao->select('*')->from(TABLE_USERVIEW)->where('account')->eq($account)->fetch();
+
+        $openedProducts = $this->dao->select('id')->from(TABLE_PRODUCT)->where('acl')->eq('open')->fetchAll('id');
+        $openedProjects = $this->dao->select('id')->from(TABLE_PROJECT)
+            ->where('acl')->eq('open')
+            ->andWhere('program')->ne(0)
+            ->andWhere('template')->eq('')
+            ->fetchAll('id');
+
+        $openedProducts = join(',', array_keys($openedProducts));
+        $openedProjects = join(',', array_keys($openedProjects));
+
+        $userView->projects = rtrim($userView->projects, ',') . ',' . $openedProjects;
+        $userView->products = rtrim($userView->products, ',') . ',' . $openedProducts;
+
+        if(!empty($acls['products']) and !$isAdmin)
+        {
+            $grantProducts = '';
+            foreach($acls['products'] as $productID)
+            {
+                if(strpos(",{$userView->products},", ",{$productID},") !== false) $grantProducts .= ",{$productID}";
+            }
+            $userView->products = $grantProducts;
+        }
+
     }
 
     /**
diff --git a/module/group/lang/resource.php b/module/group/lang/resource.php
index a4a951f37b..fa32fa4fd5 100644
--- a/module/group/lang/resource.php
+++ b/module/group/lang/resource.php
@@ -142,20 +142,27 @@ $lang->todo->methodOrder[75] = 'batchClose';
 
 /* Program. */
 $lang->resource->program = new stdclass();
-$lang->resource->program->index           = 'index';
-$lang->resource->program->transfer        = 'transfer';
-//$lang->resource->program->createGuide     = 'createGuide';
-$lang->resource->program->setPlanduration = 'setPlanduration';
-$lang->resource->program->manageMembers   = 'manageMembers';
-$lang->resource->program->export          = 'export';
-$lang->resource->program->create          = 'create';
-$lang->resource->program->edit            = 'edit';
-$lang->resource->program->start           = 'start';
-$lang->resource->program->finish          = 'finish';
-$lang->resource->program->delete          = 'delete';
-$lang->resource->program->suspend         = 'suspend';
-$lang->resource->program->activate        = 'activate';
-$lang->resource->program->close           = 'close';
+$lang->resource->program->index             = 'index';
+$lang->resource->program->transfer          = 'transfer';
+//$lang->resource->program->createGuide       = 'createGuide';
+$lang->resource->program->setPlanduration   = 'setPlanduration';
+$lang->resource->program->group             = 'group';
+$lang->resource->program->createGroup       = 'createGroup';
+$lang->resource->program->editGroup         = 'editGroup';
+$lang->resource->program->copyGroup         = 'copyGroup';
+$lang->resource->program->manageView        = 'manageView';
+$lang->resource->program->managePriv        = 'managePriv';
+$lang->resource->program->manageGroupMember = 'manageGroupMember';
+$lang->resource->program->manageMembers     = 'manageMembers';
+$lang->resource->program->export            = 'export';
+$lang->resource->program->create            = 'create';
+$lang->resource->program->edit              = 'edit';
+$lang->resource->program->start             = 'start';
+$lang->resource->program->finish            = 'finish';
+$lang->resource->program->delete            = 'delete';
+$lang->resource->program->suspend           = 'suspend';
+$lang->resource->program->activate          = 'activate';
+$lang->resource->program->close             = 'close';
 
 $lang->program->methodOrder[5]  = 'index';
 $lang->program->methodOrder[10] = 'transfer';
diff --git a/module/program/config.php b/module/program/config.php
index 1001a01a03..44cd52ddfd 100644
--- a/module/program/config.php
+++ b/module/program/config.php
@@ -11,7 +11,3 @@ $config->program->editor->suspend  = array('id' => 'comment', 'tools' => 'simple
 
 $config->program->list = new stdclass();
 $config->program->list->exportFields = 'id,name,code,type,category,status,begin,end,budget,PM,end,desc';
-
-$config->program->priv = new stdclass();
-$config->program->priv->scrum = array('product', 'story', 'productplan', 'release', 'project', 'task', 'build', 'qa', 'bug', 'testcase', 'testsuite', 'testreport', 'caselib', 'doc', 'report', 'repo', 'svn', 'git', 'search', 'tree', 'file', 'jenkins', 'job', 'ci', 'branch');
-$config->program->priv->cmmi  = $config->program->priv->scrum + array('workestimation', 'durationestimation', 'budget', 'programplan', 'review', 'reviewissue', 'weekly', 'milestone', 'design', 'issue', 'risk', 'auditplan', 'nc', 'cm', 'pssp');
diff --git a/module/program/control.php b/module/program/control.php
index b3febe08d9..bb4e20f7f0 100644
--- a/module/program/control.php
+++ b/module/program/control.php
@@ -290,7 +290,7 @@ class program extends control
             $this->group->sortResource();
             $groupPrivs = $this->group->getPrivs($groupID);
 
-            $this->view->title      = $this->lang->company->common . $this->lang->colon . $group->name . $this->lang->colon . $this->lang->group->managePriv;
+            $this->view->title      = $group->name . $this->lang->colon . $this->lang->group->managePriv;
             $this->view->position[] = $group->name;
             $this->view->position[] = $this->lang->group->managePriv;
 
@@ -312,7 +312,7 @@ class program extends control
             /* Unset not program privs. */
             foreach($this->lang->resource as $method => $label) 
             {
-                if(!in_array($method, $this->config->program->priv->{$program->template})) unset($this->lang->resource->$method);
+                if(!in_array($method, $this->config->programPriv->{$program->template})) unset($this->lang->resource->$method);
             }
         }
 
@@ -340,7 +340,7 @@ class program extends control
         $allUsers   = $this->loadModel('dept')->getDeptUserPairs($deptID);
         $otherUsers = array_diff_assoc($allUsers, $groupUsers);
 
-        $title      = $this->lang->company->common . $this->lang->colon . $group->name . $this->lang->colon . $this->lang->group->manageMember;
+        $title      = $group->name . $this->lang->colon . $this->lang->group->manageMember;
         $position[] = $group->name;
         $position[] = $this->lang->group->manageMember;
 
@@ -398,12 +398,6 @@ class program extends control
         $roles          = $this->user->getUserRoles(array_keys($users));
         $deptUsers      = $dept === '' ? array() : $this->dept->getDeptUserPairs($dept);
         $currentMembers = $this->project->getTeamMembers($projectID);
-        //$members2Import = $this->project->getMembers2Import($team2Import, array_keys($currentMembers));
-        //$teams2Import   = $this->project->getTeams2Import($this->app->user->account, $projectID);
-        //$teams2Import   = array('' => '') + $teams2Import;
-
-        /* Set menu. */
-        //$this->project->setMenu($this->projects, $project->id);
 
         $title      = $this->lang->program->manageMembers . $this->lang->colon . $project->name;
         $position[] = $this->lang->program->manageMembers;
@@ -417,9 +411,6 @@ class program extends control
         $this->view->dept           = $dept;
         $this->view->depts          = array('' => '') + $this->loadModel('dept')->getOptionMenu();
         $this->view->currentMembers = $currentMembers;
-        //$this->view->members2Import = $members2Import;
-        //$this->view->teams2Import   = $teams2Import;
-        //$this->view->team2Import    = $team2Import;
         $this->display();
     }
 
diff --git a/module/program/lang/zh-cn.php b/module/program/lang/zh-cn.php
index f6cc82b44e..0807b3c10a 100644
--- a/module/program/lang/zh-cn.php
+++ b/module/program/lang/zh-cn.php
@@ -29,13 +29,13 @@ $lang->program->realStarted     = '实际开始日期';
 $lang->program->bygrid          = '看板';
 $lang->program->bylist          = '列表';
 $lang->program->mine            = '我参与的';
-$lang->program->group           = '分组列表';
+$lang->program->group           = '分组';
 $lang->program->createGroup     = '创建分组';
 $lang->program->editGroup       = '编辑分组';
 $lang->program->copyGroup       = '复制分组';
 $lang->program->manageView      = '维护视图';
 $lang->program->managePriv      = '维护权限';
-$lang->program->manageMembers   = '维护团队';
+$lang->program->manageMembers   = '团队';
 $lang->program->transfer        = '进入项目';
 $lang->program->setPlanduration = '设置工期';
 $lang->program->export          = '导出';
diff --git a/module/program/model.php b/module/program/model.php
index d58aae2c8d..11450ec3b8 100644
--- a/module/program/model.php
+++ b/module/program/model.php
@@ -7,7 +7,7 @@ class programModel extends model
             ->where('iscat')->eq(0)
             ->andWhere('program')->eq(0)
             ->andWhere('deleted')->eq(0)
-            ->beginIF(!$this->app->user->admin)->andWhere('id')->in($this->app->user->view->projects)->fi()
+            ->beginIF(!$this->app->user->admin)->andWhere('id')->in($this->app->user->view->programs)->fi()
             ->beginIF($status != 'all')->andWhere('status')->eq($status)->fi()
             ->beginIF($this->cookie->mine)
             ->andWhere('openedBy', true)->eq($this->app->user->account)
@@ -25,7 +25,7 @@ class programModel extends model
             ->where('iscat')->eq(0)
             ->andWhere('program')->eq(0)
             ->andWhere('deleted')->eq(0)
-            ->beginIF(!$this->app->user->admin)->andWhere('id')->in($this->app->user->view->projects)->fi()
+            ->beginIF(!$this->app->user->admin)->andWhere('id')->in($this->app->user->view->programs)->fi()
             ->fetchPairs();
     }
 
@@ -36,7 +36,7 @@ class programModel extends model
             ->andWhere('template')->eq($template)
             ->andWhere('program')->eq(0)
             ->andWhere('deleted')->eq(0)
-            ->beginIF(!$this->app->user->admin)->andWhere('id')->in($this->app->user->view->projects)->fi()
+            ->beginIF(!$this->app->user->admin)->andWhere('id')->in($this->app->user->view->programs)->fi()
             ->fetchPairs();
     }
 
diff --git a/module/program/view/browsebygrid.html.php b/module/program/view/browsebygrid.html.php
index b45aae6a57..35b52da51f 100644
--- a/module/program/view/browsebygrid.html.php
+++ b/module/program/view/browsebygrid.html.php
@@ -14,6 +14,8 @@
           <li class='dropdown'>
             <a href='javascript:;' data-toggle='dropdown' class='panel-action'><i class='icon icon-ellipsis-v'></i></a>
             <ul class='dropdown-menu pull-right'>
+              <li><?php common::printIcon('program', 'group', "projectID=$project->id", $project, 'button', 'group');?></li>
+              <li><?php common::printIcon('program', 'manageMembers', "projectID=$project->id", $project, 'button', 'persons');?></li>
               <li><?php common::printicon('program', 'activate', "projectid=$project->id", $project, 'button', '', '', 'iframe', true);?></li>
               <li><?php if(common::hasPriv('program', 'edit')) echo html::a($this->createLink("program", "edit", "projectID=$project->id"), "<i class='icon-edit'></i> " . $lang->edit, '', "");?></li>
               <li><?php common::printIcon('program', 'start',   "projectID=$project->id", $project, 'button', '', '', 'iframe', true);?></li>
diff --git a/module/program/view/browsebylist.html.php b/module/program/view/browsebylist.html.php
index 5a235ca1d1..818d088095 100644
--- a/module/program/view/browsebylist.html.php
+++ b/module/program/view/browsebylist.html.php
@@ -19,7 +19,7 @@
         <th class='w-100px'><?php common::printOrderLink('end', $orderBy, $vars, $lang->program->end);?></th>
         <th class='w-100px'><?php common::printOrderLink('budget', $orderBy, $vars, $lang->program->budget);?></th>
         <th class='w-100px'><?php common::printOrderLink('PM', $orderBy, $vars, $lang->program->PM);?></th>
-        <th class='text-center w-200px'><?php echo $lang->actions;?></th>
+        <th class='text-center w-210px'><?php echo $lang->actions;?></th>
         <?php if($canOrder):?>
         <th class='w-60px sort-default'><?php common::printOrderLink('order', $orderBy, $vars, $lang->project->orderAB);?></th>
         <?php endif;?>
diff --git a/module/user/control.php b/module/user/control.php
index ff8688eb37..7f3351696d 100644
--- a/module/user/control.php
+++ b/module/user/control.php
@@ -735,7 +735,7 @@ class user extends control
                 /* Authorize him and save to session. */
                 $user->rights = $this->user->authorize($user->account);
                 $user->groups = $this->user->getGroups($user->account);
-                $user->view   = $this->user->grantUserView($user->account, $user->rights['acls']);
+                $user->view   = $this->user->grantUserView($user->account, $user->rights['acls'], $user->rights['programs']);
                 $this->session->set('user', $user);
                 $this->app->user = $this->session->user;
                 $this->loadModel('action')->create('user', $user->id, 'login');
diff --git a/module/user/model.php b/module/user/model.php
index 3448cd0be5..b579d9ea3f 100644
--- a/module/user/model.php
+++ b/module/user/model.php
@@ -757,52 +757,67 @@ class userModel extends model
         }
         else
         {
-            $groups = $this->dao->select('t1.acl')->from(TABLE_GROUP)->alias('t1')
+            $groups = $this->dao->select('t1.acl, t1.program')->from(TABLE_GROUP)->alias('t1')
                 ->leftJoin(TABLE_USERGROUP)->alias('t2')->on('t1.id=t2.group')
                 ->where('t2.account')->eq($account)
-                ->andWhere('t1.program')->eq(0)
-                ->andWhere('role')->ne('limited')
+                ->andWhere('t1.role')->ne('pgmadmin')
+                ->andWhere('t1.role')->ne('limited')
                 ->fetchAll();
             $acls = array();
             $viewAllow    = false;
             $programAllow = false;
-            $productAllow = false;
-            $projectAllow = false;
             $actionAllow  = false;
             foreach($groups as $group)
             {
                 $acl = json_decode($group->acl, true);
-                if(empty($group->acl))
+                if($group->program)
                 {
-                    $programAllow = true;
-                    $productAllow = true;
-                    $projectAllow = true;
-                    $viewAllow    = true;
-                    $actionAllow  = true;
-                    break;
-                }
+                    if(empty($group->acl))
+                    {
+                        $projectAllow = true;
+                        $productAllow = true;
+                        $viewAllow    = true;
+                        $actionAllow  = true;
+                        break;
+                    }
 
-                if(empty($acl['programs'])) $programAllow = true;
-                if(empty($acl['products'])) $productAllow = true;
-                if(empty($acl['projects'])) $projectAllow = true;
-                if(empty($acl['views']))    $viewAllow    = true;
-                if(!isset($acl['actions'])) $actionAllow  = true;
-                if(empty($acls) and !empty($acl))
+                    if(empty($acl['projects'])) $projectAllow = true;
+                    if(empty($acl['products'])) $productAllow = true;
+                    if(empty($acl['views']))    $viewAllow    = true;
+                    if(!isset($acl['actions'])) $actionAllow  = true;
+                    if(empty($acls) and !empty($acl))
+                    {
+                        $acls = $acl;
+                        continue;
+                    }
+
+                    if(!empty($acl['projects'])) $acls['projects'] = !empty($acls['projects']) ? array_merge($acls['projects'], $acl['projects']) : $acl['projects'];
+                    if(!empty($acl['products'])) $acls['products'] = !empty($acls['products']) ? array_merge($acls['products'], $acl['products']) : $acl['products'];
+                    if(!empty($acl['views']))    $acls['views']    = array_merge($acls['views'], $acl['views']);
+                    if(!empty($acl['actions']))  $acls['actions']  = !empty($acls['actions']) ? ($acl['actions'] + $acls['actions']) : $acl['actions'];
+                }
+                else
                 {
-                    $acls = $acl;
-                    continue;
-                }
+                    if(empty($group->acl))
+                    {
+                        $programAllow = true;
+                        break;
+                    }
 
-                if(!empty($acl['views'])) $acls['views'] = array_merge($acls['views'], $acl['views']);
-                if(!empty($acl['programs'])) $acls['programs'] = !empty($acls['programs']) ? array_merge($acls['programs'], $acl['programs']) : $acl['programs'];
-                if(!empty($acl['products'])) $acls['products'] = !empty($acls['products']) ? array_merge($acls['products'], $acl['products']) : $acl['products'];
-                if(!empty($acl['projects'])) $acls['projects'] = !empty($acls['projects']) ? array_merge($acls['projects'], $acl['projects']) : $acl['projects'];
-                if(!empty($acl['actions'])) $acls['actions'] = !empty($acls['actions']) ? ($acl['actions'] + $acls['actions']) : $acl['actions'];
+                    if(empty($acl['programs'])) $programAllow = true;
+                    if(empty($acls) and !empty($acl))
+                    {
+                        $acls = $acl;
+                        continue;
+                    }
+
+                    if(!empty($acl['programs'])) $acls['programs'] = !empty($acls['programs']) ? array_merge($acls['programs'], $acl['programs']) : $acl['programs'];
+                }
             }
 
             if($programAllow) $acls['programs'] = array();
-            if($productAllow) $acls['products'] = array();
             if($projectAllow) $acls['projects'] = array();
+            if($productAllow) $acls['products'] = array();
             if($viewAllow)    $acls['views']    = array();
             if($actionAllow)  unset($acls['actions']);
 
@@ -1285,17 +1300,8 @@ class userModel extends model
             $groups  = $this->dao->select('`group`')->from(TABLE_USERGROUP)->where('account')->eq($account)->fetchPairs('group', 'group');
             $groups  = ',' . join(',', $groups) . ',';
 
-            static $allProducts, $allProjects, $projectProducts, $teams;
-            if($allProducts === null) $allProducts = $this->dao->select('id,PO,QD,RD,createdBy,acl,whitelist')->from(TABLE_PRODUCT)->fetchAll('id');
-            if($allProjects === null) $allProjects = $this->dao->select('id,PO,PM,QD,RD,acl,whitelist')->from(TABLE_PROJECT)->fetchAll('id');
-            if($projectProducts === null)
-            {
-                $stmt = $this->dao->select('project,product')->from(TABLE_PROJECTPRODUCT)->query();
-                while($projectProduct = $stmt->fetch())
-                {
-                    $projectProducts[$projectProduct->product][$projectProduct->project] = $projectProduct->project;
-                }
-            }
+            static $allProducts, $allPrograms, $allProjects, $projectProducts, $teams;
+            if($allPrograms === null) $allPrograms = $this->dao->select('id,PO,PM,QD,RD,acl,whitelist')->from(TABLE_PROJECT)->where('template')->ne('')->andWhere('program')->eq(0)->fetchAll('id');
             if($teams === null)
             {
                 $stmt = $this->dao->select('root,account')->from(TABLE_TEAM)->where('type')->eq('project')->query();
@@ -1304,6 +1310,33 @@ class userModel extends model
 
             $userView = new stdclass();
             $userView->account  = $account;
+            $userView->programs = array();
+            if($isAdmin)
+            {
+                $userView->programs = join(',', array_keys($allPrograms));
+            }
+            else
+            {
+                $programs = array();
+                foreach($allPrograms as $id => $program)
+                {
+                    $programTeams = isset($teams[$id]) ? $teams[$id] : array();
+                    if($this->checkProjectPriv($program, $account, $groups, $programTeams)) $programs[$id] = $id;
+                }
+                $userView->programs = join(',', $programs);
+            }
+
+            $allProducts = $this->dao->select('id,PO,QD,RD,createdBy,acl,whitelist')->from(TABLE_PRODUCT)->where('program')->in($programs)->fetchAll('id');
+            $allProjects = $this->dao->select('id,PO,PM,QD,RD,acl,whitelist')->from(TABLE_PROJECT)->where('program')->eq($programs)->fetchAll('id');
+            if($projectProducts === null)
+            {
+                $stmt = $this->dao->select('project,product')->from(TABLE_PROJECTPRODUCT)->query();
+                while($projectProduct = $stmt->fetch())
+                {
+                    $projectProducts[$projectProduct->product][$projectProduct->project] = $projectProduct->project;
+                }
+            }
+
             $userView->products = array();
             $userView->projects = array();
             if($isAdmin)
@@ -1319,7 +1352,6 @@ class userModel extends model
                     if($this->checkProductPriv($product, $account, $groups, zget($projectProducts, $id, array()), $teams)) $products[$id] = $id;
                 }
                 $userView->products = join(',', $products);
-
                 $projects = array();
                 foreach($allProjects as $id => $project)
                 {
@@ -1328,6 +1360,7 @@ class userModel extends model
                 }
                 $userView->projects = join(',', $projects);
             }
+
             $this->dao->replace(TABLE_USERVIEW)->data($userView)->exec();
         }
 
@@ -1342,17 +1375,46 @@ class userModel extends model
      * @access public
      * @return object
      */
-    public function grantUserView($account = '', $acls = array())
+    public function grantUserView($account = '', $acls = array(), $programs = '')
     {
         if(empty($account)) $account = $this->session->user->account;
         if(empty($account)) return array();
-        if(empty($acls) and !empty($this->session->user->rights['acls'])) $acls = $this->session->user->rights['acls'];
+        if(empty($acls) and !empty($this->session->user->rights['acls']))  $acls     = $this->session->user->rights['acls'];
+        if(!$programs and isset($this->session->user->rights['programs'])) $programs = $this->session->user->rights['programs'];
 
         $userView = $this->dao->select('*')->from(TABLE_USERVIEW)->where('account')->eq($account)->fetch();
         if(empty($userView)) $userView = $this->computeUserView($account);
 
-        $openedProducts = $this->dao->select('id')->from(TABLE_PRODUCT)->where('acl')->eq('open')->fetchAll('id');
-        $openedProjects = $this->dao->select('id')->from(TABLE_PROJECT)->where('acl')->eq('open')->fetchAll('id');
+        $openedPrograms = $this->dao->select('id')->from(TABLE_PROJECT)
+            ->where('acl')->eq('open')
+            ->andWhere('program')->eq(0)
+            ->andWhere('template')->ne('')
+            ->fetchAll('id');
+
+        $openedPrograms     = join(',', array_keys($openedPrograms));
+        $userView->programs = rtrim($userView->programs, ',') . ',' . $openedPrograms;
+        if(isset($_SESSION['user']->admin)) $isAdmin = $this->session->user->admin;
+        if(!isset($isAdmin)) $isAdmin = strpos($this->app->company->admins, ",{$account},") !== false;
+
+        if(!empty($acls['programs']) and !$isAdmin)
+        {
+            $grantPrograms = '';
+            /* If is program admin, set programID to userview. */
+            if($programs) $acls['programs'] = array_merge($acls['programs'], explode(',', $programs));
+            foreach($acls['programs'] as $programID)
+            {
+                if(strpos(",{$userView->programs},", ",{$programID},") !== false) $grantPrograms .= ",{$programID}";
+            }
+            $userView->programs = $grantPrograms;
+        }
+        $programIds = explode(',', $userView->programs);
+
+        $openedProducts = $this->dao->select('id')->from(TABLE_PRODUCT)->where('acl')->eq('open')->andWhere('program')->in($programIds)->fetchAll('id');
+        $openedProjects = $this->dao->select('id')->from(TABLE_PROJECT)
+            ->where('acl')->eq('open')
+            ->andWhere('program')->in($programIds)
+            ->andWhere('template')->eq('')
+            ->fetchAll('id');
 
         $openedProducts = join(',', array_keys($openedProducts));
         $openedProjects = join(',', array_keys($openedProjects));
@@ -1360,8 +1422,6 @@ class userModel extends model
         $userView->projects = rtrim($userView->projects, ',') . ',' . $openedProjects;
         $userView->products = rtrim($userView->products, ',') . ',' . $openedProducts;
 
-        if(isset($_SESSION['user']->admin)) $isAdmin = $this->session->user->admin;
-        if(!isset($isAdmin)) $isAdmin = strpos($this->app->company->admins, ",{$account},") !== false;
         if(!empty($acls['products']) and !$isAdmin)
         {
             $grantProducts = '';
@@ -1382,6 +1442,7 @@ class userModel extends model
         }
 
         $userView->products = trim($userView->products, ',');
+        $userView->programs = trim($userView->programs, ',');
         $userView->projects = trim($userView->projects, ',');
 
         return $userView;
@@ -1400,7 +1461,7 @@ class userModel extends model
     {
         $table = '';
         if($objectType == 'product') $table = TABLE_PRODUCT;
-        if($objectType == 'project') $table = TABLE_PROJECT;
+        if($objectType == 'project' || $objectType == 'program') $table = TABLE_PROJECT;
         if(empty($table)) return false;
 
         $object = $this->dao->select('*')->from($table)->where('id')->eq($objectID)->fetch();
@@ -1432,7 +1493,7 @@ class userModel extends model
             ->query();
         while($team = $stmt->fetch()) $teams[$team->root][$team->account] = $team->account;
 
-        $field = $objectType == 'product' ? 'products' : 'projects';
+        $field = $objectType . 's';
         $stmt  = $this->dao->select("account,{$field}")->from(TABLE_USERVIEW)
             ->beginIF($users)->where('account')->in($users)->fi()
             ->query();
@@ -1455,6 +1516,13 @@ class userModel extends model
                 if(!$hasPriv and strpos(",{$userView->projects},", ",{$objectID},") !== false) $userView->projects = trim(str_replace(",{$objectID},", ',', ",{$userView->projects},"), ',');
                 $userObjects[$account]['projects'] = $userView->projects;
             }
+            elseif($objectType == 'program')
+            {
+                $hasPriv = $this->checkProjectPriv($object, $account, zget($userGroups, $account, ''), zget($teams, $objectID));
+                if($hasPriv and strpos(",{$userView->programs},", ",{$objectID},") === false) $userView->programs .= ",{$objectID}";
+                if(!$hasPriv and strpos(",{$userView->programs},", ",{$objectID},") !== false) $userView->programs = trim(str_replace(",{$objectID},", ',', ",{$userView->programs},"), ',');
+                $userObjects[$account]['programs'] = $userView->programs;
+            }
         }
 
         foreach($userObjects as $account => $data)